Mustang Panda Deploys Signed Kernel‑Mode Rootkit in CoolClient Backdoor
What Happened — Mustang Panda (aka HoneyMyte) released a new CoolClient variant that installs a signed kernel‑mode driver as a Windows service. The driver communicates via IOCTL requests and hides the malware’s processes, files, and registry entries, making detection and removal significantly harder. Kaspersky observed the upgrade in campaigns targeting government entities in Pakistan, Mongolia, Myanmar, Russia and others.
Why It Matters for Compliance & Audit Readiness
- The kernel‑level stealth defeats traditional host‑based monitoring, threatening the effectiveness of SOC 2 CC6.1 (Security Monitoring) and CC7.2 (System Operations) controls.
- Continuous evidence collection must include kernel‑driver load logs and integrity checks to provide a defensible audit trail.
Who Is Affected – Government agencies, critical‑infrastructure operators, and any organization running vulnerable Windows endpoints in the affected regions.
Recommended Actions –
- Verify that your EDR/EDR‑X solution can detect unsigned and signed kernel driver installations and monitor IOCTL activity.
- Extend your SOC 2 monitoring controls (CC6.1) to capture kernel‑mode events and retain logs for the audit period.
- Conduct a control‑mapping exercise to ensure that detection, response, and evidence‑collection processes cover kernel‑level threats.
Source: Security Affairs – Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Technical Notes – The rootkit is delivered as a signed driver (leveraging a legitimate Microsoft code‑signing certificate) installed as a Windows service, communicating via IOCTL. It hides processes, files, and registry keys, similar to the ToneShell kernel‑mode implants. No CVE is cited; the technique exploits trust in signed drivers. Source: Kaspersky analysis, cited by Security Affairs